Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md
.claude/skills/ruvnet-browser-auth-flow/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-02 | ✗→✓ | ▲ Improved | 22% | 0% |
| case-11 | ✗→✓ | ▲ Improved | -18% | 0% |
| case-05 | ✗→✓ | ▲ Improved | 2% | 0% |
| case-09 | ✗→✓ | ▲ Improved | -12% | 0% |
| case-13 | ✗→✓ | ▲ Improved | -29% | 0% |
Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured findings.md inside the RVF container.
browser-record.browser-login (credentials come from --credentials <handle> referencing browser-cookies if the run is a re-auth probe).csrf: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty.redirect: watch browser_get-url after each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary.cookie: walk document.cookie via browser_eval. For each cookie, check Secure, HttpOnly, SameSite, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each through aidefence_scan to flag PII embedded in cookie values.oauth: if the flow involves a third-party provider, capture the authorization request, verify state and nonce are present and high-entropy, verify redirect_uri matches the registered callback domain.aidefence_is_safe gate from browser-extract applies if you read the findings back).findings.md with one section per probe, severity rating per finding, and a verdict (pass / warn / fail).browser-sessions with tag: auth-probe so future audits compare against it.| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-02 | fail→pass | 18,015 | 17,153 | -5% | 1 | 1 | 0% | 2,227 | 2,725 | +22% | 0 | 0 | — |
case-11 | fail→pass | 13,488 | 9,001 | -33% | 1 | 1 | 0% | 2,654 | 2,186 | -18% | 0 | 0 | — |
case-01 | fail→fail | 14,035 | 8,748 | -38% | 1 | 1 | 0% | 765 | 1,783 | +133% | 0 | 0 | — |
case-03 | fail→fail | 8,652 | 12,889 | +49% | 1 | 1 | 0% | 872 | 2,258 | +159% | 0 | 0 | — |
case-04 | fail→fail | 5,826 | 8,528 | +46% | 1 | 1 | 0% | 415 | 1,333 | +221% | 0 | 0 | — |
case-05 | fail→pass | 11,703 | 9,364 | -20% | 1 | 1 | 0% | 2,339 | 2,394 | +2% | 0 | 0 | — |
case-06 | pass→pass | 9,116 | 7,817 | -14% | 1 | 1 | 0% | 780 | 1,130 | +45% | 0 | 0 | — |
case-07 | pass→pass | 15,776 | 10,765 | -32% | 1 | 1 | 0% | 2,582 | 2,425 | -6% | 0 | 0 | — |
case-08 | pass→pass | 10,872 | 5,235 | -52% | 1 | 1 | 0% | 1,922 | 1,494 | -22% | 0 | 0 | — |
case-09 | fail→pass | 13,524 | 9,131 | -32% | 1 | 1 | 0% | 2,589 | 2,273 | -12% | 0 | 0 | — |
case-10 | pass→pass | 11,416 | 3,587 | -69% | 1 | 1 | 0% | 1,970 | 1,260 | -36% | 0 | 0 | — |
case-12 | pass→pass | 13,788 | 4,827 | -65% | 1 | 1 | 0% | 2,287 | 1,044 | -54% | 0 | 0 | — |
case-13 | fail→pass | 14,808 | 6,756 | -54% | 1 | 1 | 0% | 2,748 | 1,945 | -29% | 0 | 0 | — |
case-14 | fail→pass | 14,934 | 3,918 | -74% | 1 | 1 | 0% | 2,274 | 843 | -63% | 0 | 0 | — |
case-15 | fail→pass | 9,016 | 2,887 | -68% | 1 | 1 | 0% | 1,595 | 973 | -39% | 0 | 0 | — |
case-16 | fail→pass | 27,931 | 2,634 | -91% | 1 | 1 | 0% | 1,533 | 1,041 | -32% | 0 | 0 | — |
case-17 | fail→fail | 10,737 | 8,861 | -17% | 1 | 1 | 0% | 1,889 | 1,944 | +3% | 0 | 0 | — |
case-18 | pass→pass | 9,884 | 4,642 | -53% | 1 | 1 | 0% | 1,682 | 1,347 | -20% | 0 | 0 | — |
case-19 | pass→pass | 5,868 | 2,306 | -61% | 1 | 1 | 0% | 1,022 | 943 | -8% | 0 | 0 | — |
case-20 | pass→pass | 10,085 | 11,188 | +11% | 1 | 1 | 0% | 1,464 | 1,209 | -17% | 0 | 0 | — |
case-21 | fail→pass | 15,122 | 12,538 | -17% | 1 | 1 | 0% | 1,819 | 1,590 | -13% | 0 | 0 | — |
case-22 | fail→pass | 11,344 | 1,051 | -91% | 1 | 1 | 0% | 1,905 | 758 | -60% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +45 percentage points is the difference between those two pass rates over the 21 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.